mitigations-slides.tex

% Copyright (c) 2023 Alexander Bluhm <bluhm@genua.de>
%
% Permission to use, copy, modify, and distribute this software for any
% purpose with or without fee is hereby granted, provided that the above
% copyright notice and this permission notice appear in all copies.
%
% THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
% WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
% MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
% ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
% WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
% ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
% OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

\documentclass[14pt,aspectratio=169]{beamer}
\usetheme{Frankfurt}
\usepackage{tikz}
\usetikzlibrary{positioning}
\usepackage{graphicx}
\usepackage{tipa}
\usepackage{alltt}
\usepackage{xcolor}
\usepackage{upquote}
\usepackage[T1]{fontenc}
\usepackage{textcomp}
\author{Alexander Bluhm}
\title{OpenBSD Security Mitigations}
\institute{\url{bluhm@genua.de}\\ \url{bluhm@openbsd.org}}
\date{September 2023}
\let\Tiny\tiny

\begin{document}

\begin{frame}
\titlepage
\end{frame}

\begin{frame}{Agenda}
\setcounter{tocdepth}{1}
\tableofcontents
\end{frame}

\section{Memory Corruption}

\subsection{Stack Overflow}
\begin{frame}{Stack Overflow}
\begin{enumerate}
  \item random gap
  \item non executable
  \item stack protector
  \item retguard
  \item immutable
  \item random location
\end{enumerate}
\end{frame}

\subsection{Stack Layout}
\begin{frame}{Stack Layout}
\begin{tikzpicture}
\path
  (0,0) node [draw,below,minimum width=2cm,minimum height=6cm] (proc) {}
  node [draw,minimum width=2cm,anchor=north,minimum height=2cm] (loc) {random}
  node [draw,minimum width=2cm,below=0 of loc.south,
    minimum height=.5cm] (gap) {gap}
  node [draw,minimum width=2cm,below=0 of gap.south,fill=red,
    minimum height=1.5cm] (stack) {stack}
  node [above=.08cm of stack.south east] (cookie) {};
\draw (loc.east) [<-] -- +(1,0) node [anchor=west]
  {26 bit within 64 bit address space};
\draw (gap.east) [<-] -- +(1,0) node [anchor=west] {random 12 bit within page};
\draw (cookie.north) -- +(-2,0);
\draw (cookie.center) -- +(-2,0) (cookie.south) -- +(-2,0);
\draw (cookie.center) [<-] -- +(1,0) node [anchor=west] {stack cookies};
\draw (stack.south) [->] -- +(0,-1);
\end{tikzpicture}
\end{frame}

\subsection{Heap Overflow}
\begin{frame}{Heap Overflow}
\begin{itemize}
  \item \texttt{malloc(3)} options
  \item guard page
  \item random chunk order
  \item canaries
  \item meta data \texttt{mprotect(2)} and \texttt{mimmutable(2)}
\end{itemize}
\end{frame}

\subsection{Heap Use-After-Free}
\begin{frame}{Heap Use-After-Free}
\begin{itemize}
  \item unmap freed
  \item junk at alloc
  \item junk at free
  \item SSH use-after-free
  \item limit chunk reuse
\end{itemize}
\end{frame}

\subsection{Return Oriented Programming}
\begin{frame}{Return Oriented Programming}
\begin{itemize}
  \item map stack
  \item retguard
  \item avoid 0xc3 due to \%rbx
  \item fork+exec
  \item \texttt{sigreturn(2)} cookie
  \item \texttt{setjmp(3)}, \texttt{longjmp(3)} cookie
  \item ARM BTI \& Intel IBT endbr64
  \item random relinking
\end{itemize}
\end{frame}

\subsection{Mapping Protection}
\begin{frame}{Mapping Protection}
\begin{itemize}
  \item \texttt{mprotect(2)}
  \begin{itemize}
    \item W\^{}X
    \item xonly
  \end{itemize}
  \item \texttt{mimmutable(2)}
  \item \texttt{mmap(2)}
  \begin{itemize}
    \item MAP\_STACK
    \item MAP\_CONCEAL
  \end{itemize}
\end{itemize}
\end{frame}

\subsection{Address Space Protection}
\begin{frame}{Address Space Protection}
\begin{tikzpicture}
\path
  (0,0) node [draw,below,minimum width=2cm,minimum height=6cm] (proc) {}
  +(0,-0.5) node [draw,minimum width=2cm,fill=red] (stack) {stack}
  +(0,-1.4) node [draw,minimum width=2cm,fill=green] (jit) {JIT}
  +(0,-2.3) node [draw,minimum width=2cm,fill=green] (heap) {heap}
  +(0,-3.1) node [draw,minimum width=2cm,fill=blue] (bss) {bss}
  +(0,-3.9) node [draw,minimum width=2cm,fill=yellow] (data) {data}
  +(0,-4.7) node [draw,minimum width=2cm,fill=brown] (rodata) {rodata}
  +(0,-5.5) node [draw,minimum width=2cm,fill=magenta] (text) {text};
\draw (stack.east) [<-] -- +(1,0) node [anchor=west] {read/write immutable};
\draw (jit.east) +(1,-.1) node [anchor=south west] (mwrite)
  {mprotect(PROT\_WRITE)} (mwrite.west) [->] -- (jit.east);
\draw (jit.east) +(1,.1) node [anchor=north west] (mexec)
  {mprotect(PROT\_EXEC)} (mexec.west) [->] -- (jit.east);
\draw (heap.east) [<-] -- +(1,0) node [anchor=west] {read/write};
\draw (bss.east) [<-] -- +(1,0) node [anchor=west] {read/write immutable};
\draw (data.east) [<-] -- +(1,0) node [anchor=west] {read/write immutable};
\draw (rodata.east) [<-] -- +(1,0) node [anchor=west] {read immutable};
\draw (text.east) [<-] -- +(1,0) node [anchor=west] {exec immutable};
\end{tikzpicture}
\end{frame}

\subsection{Hardware xonly}
\begin{frame}{Hardware xonly}
\begin{itemize}
  \item arm64, riscv64 have RWX
  \item new amd64 have PKU
\end{itemize}
\end{frame}

\subsection{Opportunistic xonly}
\begin{frame}[fragile=singleslide]{Opportunistic xonly}
\begin{verbatim}
  addr = mmap(NULL, 4096, PROT_NONE,
      MAP_PRIVATE | MAP_ANON, -1, 0);
  mprotect(addr, 4096, PROT_READ);
  printf("%p: %08x\n", addr, *(int *)addr);
  mprotect(addr, 4096, PROT_EXEC);
  printf("%p: %08x\n", addr, *(int *)addr);
\end{verbatim}
\begin{verbatim}
  0x73d15433000: 00000000
  0x73d15433000: 00000000
\end{verbatim}
\end{frame}

\subsection{Trap xonly}
\begin{frame}[fragile=singleslide]{Trap xonly}
\begin{verbatim}
  addr = mmap(NULL, 4096, PROT_NONE,
      MAP_PRIVATE | MAP_ANON, -1, 0);
  mprotect(addr, 4096, PROT_READ);
  mprotect(addr, 4096, PROT_EXEC);
  printf("%p: %08x\n", addr, *(int *)addr);
\end{verbatim}
\begin{verbatim}
  Segmentation fault (core dumped)
\end{verbatim}
\end{frame}

\section{Randomness}

\subsection{Random Everywhere}
\begin{frame}{Random Everywhere}
\begin{itemize}
  \item \texttt{arc4random(3)}
  \item \texttt{arc4random\_uniform(3)}
  \item \texttt{srand\_deterministic(seed)}
  \item \texttt{getentropy(2)}
  \item ELF header \texttt{.openbsd.randomdata}
  \item boot /etc/random.seed
\end{itemize}
\end{frame}

\subsection{Address Space Layout Randomization}
\begin{frame}{Address Space Layout Randomization}
\begin{enumerate}
  \item shared library mapping
  \item heap \texttt{mmap(2)}
  \item stack gap
  \item PIE program text
  \item relink libc
  \item relink \texttt{sshd(8)}
\end{enumerate}
\end{frame}

\subsection{Address Space Layout}
\begin{frame}{Address Space Layout}
\begin{tikzpicture}
\path
  (0,0) node [draw,below,minimum width=2cm,minimum height=6cm] (proc) {}
  +(0,-0.5) node [draw,minimum width=2cm,fill=red] (stack) {stack}
  +(0,-1.7) node [draw,minimum width=2cm,fill=green] (heap1) {heap1}
  +(0,-2.8) node [draw,minimum width=2cm,fill=blue] (heap2) {heap2}
  +(0,-3.7) node [draw,minimum width=2cm,fill=yellow] (lib1) {lib1}
  +(0,-4.7) node [draw,minimum width=2cm,fill=brown] (lib2) {lib2}
  +(0,-5.5) node [draw,minimum width=2cm,fill=magenta] (prog) {prog};
\draw (stack.north east) [<-] -- +(1,0) node [anchor=west] {stack gap};
\draw (heap1.east) [<-] -- +(1,0) node [anchor=west] {map at random address};
\path (heap1.east) -- (heap2.east) coordinate [midway] (heap);
\draw (heap) [<-] -- +(1,0) node [anchor=west] {guard page};
\draw (heap2.east) [<-] -- +(1,0) node [anchor=west] {unmap after free};
\path (lib1.east) -- (lib2.east) coordinate [midway] (lib)
  (lib) +(1,0) node [anchor=west] (ldso) {load randomly};
\draw (lib1.east) [<-] -- (ldso.west);
\draw (lib2.east) [<-] -- (ldso.west);
\draw (prog.south east) [<-] -- +(1,0) node [anchor=west]
  {position independent executable};
\end{tikzpicture}
\end{frame}

\section{System Calls}

\subsection{Process Mapping}
\begin{frame}[fragile=singleslide]{Process Mapping}
\begin{verbatim}
  sleep 1 & procmap $!
\end{verbatim}
\begin{itemize}
  \item \verb/Start End/ random
  \item \verb/rwxSeIpc/ xonly, stack, system call entry, immutable
  \begin{itemize}
    \item \verb/--x-eIp+/ text
    \item \verb/r----Ip+/ read only
    \item \verb/rw---Ip-/ data
    \item \verb/rw----p-/ heap
    \item \verb/rw-S-Ip-/ stack
  \end{itemize}
\end{itemize}
\end{frame}

\subsection{Kernel Exec}
\begin{frame}{Kernel Exec}
\begin{itemize}
  \item check argc > 0
  \item random stack
  \item random signal cookie
  \item exec pledge
  \item setuid open stdin, stdout, stderr
\end{itemize}
\end{frame}

\subsection{Dynamic Loader}
\begin{frame}{Dynamic Loader}
\begin{itemize}
  \item init random \texttt{getentropy(2)}
  \item fix permissions \texttt{mimmutable(2)}
  \item random layout \texttt{mmap(2)}
  \item syscall area \texttt{msyscall(2)}
  \item exec area \texttt{pinsyscall(2)}
  \item lazy-binding \texttt{kbind(2)}
\end{itemize}
\end{frame}

\subsection{Lazy Binding kbind(2)}
\begin{frame}{Lazy Binding kbind(2)}
\begin{tikzpicture}
\draw
  node [draw,minimum height=3cm,minimum width=1.5cm] (prog) {Prog};
\draw (prog.east) [->] -- ++(4,0) node [midway,above] {function()} -- ++(0,-1)
  node [draw,below] (plt) {PLT};
\draw (plt.south) [<-,dotted,thick] -- ++(0,-2)
  node [midway,right,align=center] {read\\ indirect\\ jump}
  node [draw,solid,thin,below] (got) {GOT};
\draw (got.west) [<-,dotted,thick,red] -- ++(-2,0)
  node [midway,below,align=center] {modify\\ function address}
  node [draw,solid,thin,left,black] (ldso) {ld.so};
\draw (plt.west) [<->] -|
  node [near end,left,align=center] {lazy\\ binding} (ldso);
\draw (plt.east) [->] -- ++(3,0) node [midway,above] {function()}
  node [draw,right,minimum height=3cm,minimum width=1.5cm] (lib) {Lib};
\end{tikzpicture}
\end{frame}

\section{Userland Programming}

\subsection{Pledge and Unveil}
\begin{frame}{Pledge and Unveil}
\begin{itemize}
  \item ps -ax -o stat | grep p $\Rightarrow$ 86\% pledged
  \item ps -ax -o stat | grep U $\Rightarrow$ 39\% unveiled
  \item easy to use
  \item structures design securely
  \item daily violation mail
  \item \texttt{lastcomm(1)}, \texttt{acct(5)}, \texttt{accton(8)}
\end{itemize}
\end{frame}

\subsection{Privilege Separation in Processes}
\begin{frame}{Privilege Separation in Processes}
\begin{itemize}
  \item identify isolated tasks with high risk
  \item \texttt{socketpair(2)}
  \item \texttt{fork(2)}
  \item \texttt{chroot(2)}
  \item \texttt{setuid(2)}
  \item \texttt{pledge(2)}
  \item \texttt{imsg\_init(3)}
  \item file descriptor passing
\end{itemize}
\end{frame}

\subsection{Programs with Privsep}
\begin{frame}{Programs with Privsep}
\begin{tikzpicture}
\draw [grow=right,level distance=2cm,sibling distance=3cm]
  (0,0) node [draw,circle,align=center] (ospfd) {ospfd}
  [edge from parent/.style={draw,->}]
  child { node [draw,circle,align=center] (rde) {route\\ decision\\ engine} }
  child { node [draw,circle,align=center] (ospfe) {ospf\\ engine} };
\draw [grow'=right,level distance=2cm,sibling distance=2cm]
  (4.3,0) node [draw,circle,align=center] (relayd) {relayd}
  [edge from parent/.style={draw,->}]
  child { node [draw,circle,align=center] (proc1) {proc1} }
  child { node [draw,circle,align=center] (proc2) {proc2} }
  child { node [draw,circle,align=center,yshift=-1cm] (procn) {procN} };
\draw [grow=down,level distance=3cm]
  (8.5,1) node [draw,circle,align=center] (parent) {priv\\ parent}
  [edge from parent/.style={draw,->}]
  child { node [draw,circle,align=center] (syslogd) {syslogd} };
\end{tikzpicture}
\end{frame}

\subsection{fork+exec}
\begin{frame}{fork+exec}
\begin{tikzpicture}
\path
  (0,0) node [draw,below,minimum width=2cm,minimum height=6cm] (p) {}
  +(0,-0.6) node [draw,minimum width=2cm,fill=red,minimum height=1cm] {stack}
  +(0,-1.8) node [draw,minimum width=2cm,fill=green] {heap}
  +(0,-3.2) node [draw,minimum width=2cm,fill=yellow] {lib1}
  +(0,-5.5) node [draw,minimum width=2cm,fill=magenta] {prog};
\path
  (4,0) node [draw,below,minimum width=2cm,minimum height=6cm] (f) {}
  +(0,-0.6) node [draw,minimum width=2cm,fill=red,minimum height=1cm] {stack}
  +(0,-1.8) node [draw,minimum width=2cm,fill=green] {heap}
  +(0,-3.2) node [draw,minimum width=2cm,fill=yellow] {lib1}
  +(0,-5.5) node [draw,minimum width=2cm,fill=magenta] {prog};
\path
  (8.5,0) node [draw,below,minimum width=2cm,minimum height=6cm] (e) {}
  +(0,-0.6) node [draw,minimum width=2cm,fill=red] {stack}
  +(0,-4.1) node [draw,minimum width=2cm,fill=yellow] {lib1}
  +(0,-5.2) node [draw,minimum width=2cm,fill=magenta] {prog};
\draw [->] (p) to [thick,bend left,edge label={\texttt{fork(2)}}] (f);
\draw [->] (f) to [thick,bend left,edge label={\texttt{execve(2)}}] (e);
\end{tikzpicture}
\end{frame}

\subsection{API Changes}
\begin{frame}{API Changes}
\begin{itemize}
  \item \texttt{strlcpy(3)}, \texttt{strlcat(3)}
  \item \texttt{reallocarray(3)}
  \item \texttt{explicit\_bzero(3)}
  \item \texttt{freezero(3)}
  \item \texttt{malloc\_conceal(3)}
  \item \texttt{printf(3)} without \%n
\end{itemize}
\end{frame}

\subsection{File Descriptors}
\begin{frame}{File Descriptors}
\begin{itemize}
  \item \texttt{getdtablecount(2)}
  \item \texttt{sendsyslog(2)}
  \item \texttt{socket(2)} type SOCK\_DNS
\end{itemize}
\end{frame}

\subsection{Ports Pain}
\begin{frame}{Ports Pain}
\begin{itemize}
  \item BTI and IBT
  \item xonly
  \item map stack
  \item W\^{}X
  \item otto@ malloc
\end{itemize}
\end{frame}

\subsection{Default and Force}
\begin{frame}{Default and Force}
\begin{itemize}
  \item control: kernel, libc, base
  \item adapt: ports
  \item last resort: mount and program flags
  \begin{itemize}
    \item mount -o wxallowed
    \item ld -z wxneeded
    \item ld -z nobtcfi
    \item NOT execstack, force-bti, force-ibt
  \end{itemize}
\end{itemize}
\end{frame}

\subsection{SSH Agent Library Exploit}
\begin{frame}{SSH Agent Library Exploit}
\texttt{dlopen(3)} 4 libraries:
\begin{itemize}
  \item ELF header executable stack
  \item init signal handler SIGSEGV
  \item ELF flag NODELETE
  \item on load segmentation fault
\end{itemize}
\end{frame}

\section{Final}

\subsection{Not yet}
\begin{frame}{Not Yet}
\begin{itemize}
  \item ARM pointer authentication
  \item shadow stack
  \item remove \texttt{syscall(2)}
\end{itemize}
\end{frame}

\subsection{Conclusion}
\begin{frame}{Conclusion}
\begin{itemize}
  \item powerful combination
  \item cheap and effective
  \item always on
  \item works with ports
\end{itemize}
\end{frame}

\subsection{Questions}
\begin{frame}{Questions}
\begin{center}
\begin{tikzpicture}
\draw [font=\Huge] node {?};
\end{tikzpicture}
\end{center}
\end{frame}

\end{document}